Scenario: Setting up cross-realm trust

 

Here are the prerequisites and objectives for setting up cross-realm trust on your network.

 

Situation

You are a security administrator for a large wholesale company. Currently you manage security for systems used by employees of the Order Receiving Department and the Shipping Department. You have configured a Kerberos server for the Order Receiving Department. You have configured network authentication service in the System i™ environment in that department to point to that Kerberos server. The Shipping Department consists of a System i product that has a Kerberos server configured in i5/OS® PASE. You have also configured network authentication service on this System i product to point to the Kerberos server in i5/OS PASE.

Because users in both realms need to use services stored on systems located in each department, you want both of the Kerberos servers in each department to authenticate users regardless of which Kerberos realm they are located in.

 

Objectives

In this scenario, MyCo, Inc. wants to establish a trust relationship between two existing Kerberos realms. One realm consists of a Windows® 2000 server acting as the Kerberos server for the Order Receiving Department. This server authenticates users within that department to services located on a System i platform. The other realm consists of a Kerberos server configured in i5/OS PASE on one System i platform, which provides services for the users within the Shipping Department. Your users need to be authenticated to services in both departments.

The objectives of this scenario are as follows:

 

Details

Here is a detailed description of the environment that this scenario describes, including a figure that shows the topology and all major elements of that environment and how they relate to each other.

Order Receiving Department

System A

Windows 2000 server

Client PCs

Shipping Department

System B

Client PCs

 

Prerequisites and assumptions

In this scenario, the following assumptions have been made to focus on the tasks that involve establishing a trust relationship between two pre-existing Kerberos realms.

System A prerequisites

  1. All system requirements, including software and operating system installation, have been verified.

    To verify that the required licensed programs have been installed, follow these steps:

    1. In iSeries Navigator, expand your system > Configuration and Service > Software > Installed Products.

    2. Ensure that all the necessary licensed programs are installed.

  2. All necessary hardware planning and setup have been completed.

  3. TCP/IP and basic system security have been configured and tested on System A.

  4. Network authentication service has been configured and tested.

  5. A single DNS server is used for host name resolution for the network. Host tables are not used for host name resolution.

    The use of host tables with Kerberos authentication might result in name resolution errors or other problems. For more detailed information about how host name resolution works with Kerberos authentication, see Host name resolution considerations.

System B prerequisites

  1. All system requirements, including software and operating system installation, have been verified.

    To verify that the required licensed programs have been installed, follow these steps:

    1. In iSeries Navigator, expand your system > Configuration and Service > Software > Installed Products.

    2. Ensure that all the necessary licensed programs are installed.

  2. All necessary hardware planning and setup have been completed.

  3. TCP/IP and basic system security have been configured and tested on your system.

  4. Network authentication service has been configured and tested.

Windows 2000 server prerequisites

  1. All necessary hardware planning and setup have been completed.

  2. TCP/IP has been configured and tested on your server.

  3. Microsoft Active Directory has been configured and tested.

  4. Each user within the Order Department has been defined in Microsoft Active Directory with a principal name and password.

 

Configuration steps

To set up a trust relationship between two realms, complete these steps.

  1. Completing the planning work sheets
    Before setting up cross-realm trust, complete these planning work sheets.
  2. Ensuring that the Kerberos server in i5/OS PASE on System B has started
    Before you configure cross-realm trust, you need to ensure that the i5/OS PASE Kerberos server has started.
  3. Creating a cross-realm trust principal on the i5/OS PASE Kerberos server
    To create a cross-realm trust principal on the i5/OS PASE Kerberos server, follow these steps.
  4. Changing encryption values on i5/OS PASE Kerberos server
    To operate with Windows workstations, you need to change the Kerberos server default encryption settings so that clients can be authenticated to the i5/OS PASE Kerberos server.
  5. Configuring the Windows 2000 server to trust SHIPDEPT.MYCO.COM
    Now that you have configured System B to trust the ORDEPT.MYCO.COM realm, you need to configure the Windows 2000 server to trust the SHIPDEPT.MYCO.COM realm.
  6. Adding the SHIPDEPT.MYCO.COM realm to System A
    You must define the SHIPDEPT.MYCO.COM realm on System A so System A can determine where to find the i5/OS PASE Kerberos server within the SHIPDEPT.MYCO.COM realm.

 

Parent topic:

Scenarios: Using network authentication service in a Kerberos network